ISO 27001 clause 9.2
Independent ISO 27001 internal audits for organisations that need specialist audit competence, additional capacity or an objective assessment of their ISMS. The standard requires internal audits at planned intervals, conducted objectively and impartially. Qualified internal people can do this where competence and impartiality are maintained; an external auditor is one way to achieve it, not a requirement.
What the standard asks for
Clause 9.2 is short, and every part of it is checked by your certification body at the next surveillance visit. These are the five things it asks of you.
Not a one-off. The organisation runs internal audits on a programme, so that the whole management system is covered over time rather than the same easy corner being re-audited every year.
Frequency, methods, responsibilities, planning requirements and reporting - defined and maintained, not improvised the month before the certification body arrives.
Auditors are selected, and audits conducted, so that the process is objective and impartial. This is the requirement most internal audits quietly fail.
The findings go to the management that can act on them, and they become an input to the management review under clause 9.3.
The audit programme and its results are kept as documented information. An audit nobody can evidence did not happen, as far as a certification body is concerned.
Described rather than quoted: ISO/IEC 27001 is a purchasable standard, and the authoritative wording is in your own copy of it.
Independence
Objectivity and impartiality are requirements of the audit process itself. If the person auditing your ISMS also built or runs it, the audit has lost the one thing it was for - so the auditor is always someone who had no part in the work.
Straightforward: we did not design your controls, write your policies or choose your Statement of Applicability, so there is nothing for us to be protective of. That is the cleanest version of this engagement.
Then the audit is run by someone who did not do that work. The auditor is named in the audit plan and declares no involvement in the activities in scope, and the report states the separation explicitly - so your certification body can see how impartiality was preserved rather than take our word for it. Where the separation cannot be made honestly, we say so and you use another auditor. That is a better outcome than a report your external auditor discounts.
Auditors must remain independent of the activities they audit. Where Kellwick has supported implementation or ongoing management, any subsequent internal audit is subject to an independence and conflict-of-interest review. The assigned auditor must not have participated in the work being audited. Where sufficient objectivity and impartiality cannot be assured, Kellwick will decline the affected scope or recommend independent external assurance.
We are an independent consulting and internal audit practice, not a certification body. An internal audit from us is your clause 9.2 audit - it is not certification, and it does not guarantee any external audit outcome.
What you get
The audit days are set by your scope and stated in the proposal. You know what is being examined, who we need, and exactly what lands at the end.
Agreed before anything starts: scope, audit criteria, how we will sample, who we need and when. You know exactly what is being examined.
Clauses 4-10 and the Annex A controls in your Statement of Applicability. Interviews with control owners, and sampling of the evidence as it actually exists - not as the policy says it should.
Each finding recorded as a nonconformity, an observation or an opportunity for improvement, with the clause or control it sits against and the evidence behind it.
A documented, evidence-based report for your audit programme: scope, criteria, sampled evidence and classified findings, ready for management review and for your external auditor to examine.
The findings shaped as an input to clause 9.3, so the review has something to review rather than a verbal summary.
A walkthrough with the people who have to act on the findings, so the report does not go straight into a folder.
Scoped on a call
Your clause 9.2 internal audit, run by an auditor with no stake in the system being audited - with the report your management review actually needs.
What changes the price: Number of controls in your Statement of Applicability · Number of legal entities and sites in scope · How many control owners have to be interviewed · Whether the last audit left open nonconformities to verify
Auditors remain independent of the activities they audit. Where Kellwick supported implementation or ongoing management, the audit follows an independence and conflict-of-interest review and is assigned to an auditor who took no part in that work; where objectivity cannot be assured, we decline that scope or recommend external assurance.
Questions
No, and they are not interchangeable. The internal audit is yours: the standard requires you to run it, and you own the findings. The certification body's Stage 1, Stage 2 and surveillance audits are external and end in a certificate. One of the things the external auditor checks is that your internal audit actually happened and was done properly.
They can, and many organisations do - but the standard requires the audit to be conducted so that objectivity and impartiality are assured, and that is the hard part in a small team. Someone cannot audit their own work, and in a company where three people run everything there is often nobody left who is genuinely independent of the area being audited. That is the usual reason this gets outsourced.
Only after an independence and conflict-of-interest review. Objectivity and impartiality are a requirement of the audit, so where we have done readiness, remediation or ongoing management work for you, the internal audit is assigned to an auditor who took no part in that work, and the audit plan and report record it. Where sufficient objectivity cannot be assured, we decline the affected scope or recommend independent external assurance.
No. Clause 9.2 requires internal audits at planned intervals under an audit programme - it does not say every clause and control must be audited every year. A programme can cover the whole ISMS across the three-year certification cycle, weighted by risk. Many certified organisations still run one audit a year, because their certification body visits annually and will ask for audit results since the last visit.
It depends on the size of your Statement of Applicability, the number of entities and sites in scope, and how many control owners have to be interviewed. For a single entity with one ISMS scope it is often a few days of audit effort; larger scopes take longer. The proposal states the audit days, and the elapsed time depends mostly on how quickly interviews can be scheduled.
That is the audit working. A finding raised by your own internal audit, with a corrective action underway, is a healthy management system - it is far better than the same issue being found by the certification body, where it becomes a finding on your certificate rather than a line in your own improvement log.
The scope, the deliverables and the factors that move the price are all published - the figure is agreed on a short call, because it depends on the size of your Statement of Applicability and how many entities are in scope. Nothing starts before the scope and the fixed price are agreed in writing.
Tell us the size of your Statement of Applicability and when your next surveillance visit is. We will confirm the scope and a fixed price in writing before anything starts. Running ISO 9001 or ISO 42001 as well? We can audit them in one programme.